MAL-2023-1218 Malicious code in jest-cucumber-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e2fbf023b3a861ceda4ee89f2c188d2cf7e1b274a07fb7f0df58b9d86c6935b2 The OpenSSF Package Analysis project identified 'jest-cucumber-reporter' @ 0.0.9 npm as malicious. It is considered malicious because: - The...

Design/Logic Flaw

A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M2200NC, RUGGEDCOM M969...

CVE-2023-36923

SAP SQLA for PowerDesigner 17 bundled with SAP PowerDesigner 16.7 SP06 PL03, allows an attacker with local access to the system, to place a malicious library, that can be executed by the application. An attacker could thereby control the behavior of the application...

Missing sanityCheckUnderlying Call in Certain Functions of OptionsPositionManager Contract

Lines of code Vulnerability details Bug Description In the OptionsPositionManager contract, there is a missing call to the sanityCheckUnderlying function at the beginning of the sellOptions and close functions. These functions involve interactions with option assets and underlying tokens. However...

getTickAtSqrtRatio used in TokenisableRange.sol to calculate lower and upper ticks is used without letting for overflow behavior, which is required

Lines of code Vulnerability details Impact The function getTickAtSqrtRatio is used multiple times in the TokenisableRange.sol, but the library TickMath.sol is compiled with pragma solidity ^0.8.4 as you can see here which doesn't allow for overflows, and since the function is not unchecked,...

Malicious code in my-fallen-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7c1f73f0c85f62e81e5bb2b99f08089c34ecaa76487bac79f482b75c131ef13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Miusing empty string insteaf of oracleData in updateExchangeRate

Lines of code Vulnerability details Impact contract has this storage: /// @notice oracleData bytes public oracleData; updated, rate = oracle.get""; Instead of oracle.get"", it should use proper oracle data which was set otherwise it can lead to undefined behavior where oracle expects data. Proof ...

MAL-2023-1263 Malicious code in papaya_pear_vicious (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 080555e8b0e713640ab3072d60fca6f3144f3738c13d3b46d93e89ebf87d0a15 The OpenSSF Package Analysis project identified 'papayapearvicious' @ 3.0.0 npm as malicious. It is considered malicious because: - The package...

GHSA-5R98-F33J-G8H7 pnpm incorrectly parses tar archives relative to specification

Summary It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. Details The TAR format is an append-only archive format, and as such, the specification for how to update a...

New P2PInfect Worm Targets Redis Servers with Undocumented Breach Methods

The P2PInfect peer-to-peer P2 worm has been observed employing previously undocumented initial access methods to breach susceptible Redis servers and rope them into a botnet. "The malware compromises exposed instances of the Redis data store by exploiting the replication feature," Cado Security...

SolarWinds Platform 2023.2.0 < 2023.3 Multiple Vulnerabilities

The version of SolarWinds Platform installed on the remote host is prior to 2023.3. It is, therefore, affected by multiple vulnerabilities as referenced in the solarwindsplatform20233 advisory. - Access Control Bypass Vulnerability in the SolarWinds Platform that allows an underprivileged user to...

CVE-2023-33224

The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges...

CVE-2023-33224

The CVE-2023-33224 entry concerns the SolarWinds Platform (SolarWinds Orion Platform) and describes an Incorrect Behavior Order Vulnerability. The issue allows users with administrative access to the SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges, due to an i...

CVE-2023-33224 SolarWinds Platform Incorrect Behavior Order Vulnerability

The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges...

Important: golang

Issue Overview: html/template: improper handling of empty HTML attributes. The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains...

GHSA-F5X6-7QGP-JHF3 ecrecover can return undefined data if signature does not verify

Impact the ecrecover precompile does not fill the output buffer if the signature does not verify, see https://github.com/ethereum/go-ethereum/blob/b058cf454b3bdc7e770e2b3cec83a0bcb48f55ee/core/vm/contracts.goL188. however, the ecrecover builtin will still return whatever is at memory location 0...

ecrecover can return undefined data if signature does not verify

Impact the ecrecover precompile does not fill the output buffer if the signature does not verify, see https://github.com/ethereum/go-ethereum/blob/b058cf454b3bdc7e770e2b3cec83a0bcb48f55ee/core/vm/contracts.goL188. however, the ecrecover builtin will still return whatever is at memory location 0...

MAL-2023-1301 Malicious code in some_internal_package_for_testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 53107273160f2452143bcbee916077e6adbca0f10d5f2d80e0afeb276d92d788 The OpenSSF Package Analysis project identified 'someinternalpackagefortesting' @ 99.9.9 npm as malicious. It is considered malicious because: -...

Malicious code in hellodependency5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis caa3595977335e1bacb314c6a0a7866651c4eea9f9eb5d3b4d6a4f7d3458a988 The OpenSSF Package Analysis project identified 'hellodependency5' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in hellodependency3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a806e7ee360d2e51a441f2f736fb58affcd5e7028d5e442fb2ea340f4655f187 The OpenSSF Package Analysis project identified 'hellodependency3' @ 1.0.4 npm as malicious. It is considered malicious because: - The package...